Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d80489afae88d257cadca54eb5a41a70_mafia_JC.exe
Resource
win7-20230824-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d80489afae88d257cadca54eb5a41a70_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
d80489afae88d257cadca54eb5a41a70_mafia_JC.exe
-
Size
486KB
-
MD5
d80489afae88d257cadca54eb5a41a70
-
SHA1
e6aed8780e58c6e529bbfacf6215dc7794e81d90
-
SHA256
0026f79d1a8de8279d198ec8024b6347320a071ddf11da91ef592745c655d5c8
-
SHA512
0cda6123a67ec3c62d43f74dcf06526b443dbd29e223c94ddc162c4f04d5412694f1cc6ae891a8385bb0a21dfb8f0e2e66990ea1a5e52350eff07180789fbdcd
-
SSDEEP
12288:/U5rCOTeiD0nllPWwKhcy6FfB1aci0SuNZ:/UQOJD+/PWNhkFfk0SuN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4556 8165.tmp 3992 8230.tmp 956 82FB.tmp 2164 83B7.tmp 400 8453.tmp 5016 84FF.tmp 548 85AB.tmp 3488 8666.tmp 4968 8712.tmp 1376 87BE.tmp 4656 885A.tmp 1008 8935.tmp 60 89F0.tmp 1316 8AAC.tmp 1380 8C23.tmp 1788 8D1D.tmp 3356 8DC9.tmp 2156 8EB3.tmp 1528 8F30.tmp 3424 9078.tmp 660 9114.tmp 1508 91EF.tmp 2428 928B.tmp 2220 92F9.tmp 412 93B4.tmp 4700 9441.tmp 1388 94FC.tmp 3452 95C8.tmp 3036 9664.tmp 3824 9700.tmp 4536 97EA.tmp 2856 9896.tmp 4312 9923.tmp 2052 99DE.tmp 2172 9A8A.tmp 4884 9B17.tmp 4736 9B94.tmp 4180 9C21.tmp 3160 9CBD.tmp 3504 9D2A.tmp 4052 9DC6.tmp 5068 9E53.tmp 1052 9EE0.tmp 4988 9F5D.tmp 752 9FDA.tmp 4428 A076.tmp 4516 A112.tmp 3564 A1AE.tmp 2820 A23B.tmp 3712 A2D7.tmp 3656 A354.tmp 3652 A3F1.tmp 2076 A48D.tmp 392 A519.tmp 2236 A587.tmp 4636 A604.tmp 4388 A690.tmp 4452 A70D.tmp 1892 A79A.tmp 2012 A836.tmp 1324 A8C3.tmp 4308 A950.tmp 3876 A9DC.tmp 5040 AA78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4556 4712 d80489afae88d257cadca54eb5a41a70_mafia_JC.exe 82 PID 4712 wrote to memory of 4556 4712 d80489afae88d257cadca54eb5a41a70_mafia_JC.exe 82 PID 4712 wrote to memory of 4556 4712 d80489afae88d257cadca54eb5a41a70_mafia_JC.exe 82 PID 4556 wrote to memory of 3992 4556 8165.tmp 83 PID 4556 wrote to memory of 3992 4556 8165.tmp 83 PID 4556 wrote to memory of 3992 4556 8165.tmp 83 PID 3992 wrote to memory of 956 3992 8230.tmp 84 PID 3992 wrote to memory of 956 3992 8230.tmp 84 PID 3992 wrote to memory of 956 3992 8230.tmp 84 PID 956 wrote to memory of 2164 956 82FB.tmp 85 PID 956 wrote to memory of 2164 956 82FB.tmp 85 PID 956 wrote to memory of 2164 956 82FB.tmp 85 PID 2164 wrote to memory of 400 2164 83B7.tmp 86 PID 2164 wrote to memory of 400 2164 83B7.tmp 86 PID 2164 wrote to memory of 400 2164 83B7.tmp 86 PID 400 wrote to memory of 5016 400 8453.tmp 87 PID 400 wrote to memory of 5016 400 8453.tmp 87 PID 400 wrote to memory of 5016 400 8453.tmp 87 PID 5016 wrote to memory of 548 5016 84FF.tmp 88 PID 5016 wrote to memory of 548 5016 84FF.tmp 88 PID 5016 wrote to memory of 548 5016 84FF.tmp 88 PID 548 wrote to memory of 3488 548 85AB.tmp 89 PID 548 wrote to memory of 3488 548 85AB.tmp 89 PID 548 wrote to memory of 3488 548 85AB.tmp 89 PID 3488 wrote to memory of 4968 3488 8666.tmp 90 PID 3488 wrote to memory of 4968 3488 8666.tmp 90 PID 3488 wrote to memory of 4968 3488 8666.tmp 90 PID 4968 wrote to memory of 1376 4968 8712.tmp 92 PID 4968 wrote to memory of 1376 4968 8712.tmp 92 PID 4968 wrote to memory of 1376 4968 8712.tmp 92 PID 1376 wrote to memory of 4656 1376 87BE.tmp 93 PID 1376 wrote to memory of 4656 1376 87BE.tmp 93 PID 1376 wrote to memory of 4656 1376 87BE.tmp 93 PID 4656 wrote to memory of 1008 4656 885A.tmp 94 PID 4656 wrote to memory of 1008 4656 885A.tmp 94 PID 4656 wrote to memory of 1008 4656 885A.tmp 94 PID 1008 wrote to memory of 60 1008 8935.tmp 95 PID 1008 wrote to memory of 60 1008 8935.tmp 95 PID 1008 wrote to memory of 60 1008 8935.tmp 95 PID 60 wrote to memory of 1316 60 89F0.tmp 96 PID 60 wrote to memory of 1316 60 89F0.tmp 96 PID 60 wrote to memory of 1316 60 89F0.tmp 96 PID 1316 wrote to memory of 1380 1316 8AAC.tmp 97 PID 1316 wrote to memory of 1380 1316 8AAC.tmp 97 PID 1316 wrote to memory of 1380 1316 8AAC.tmp 97 PID 1380 wrote to memory of 1788 1380 8C23.tmp 98 PID 1380 wrote to memory of 1788 1380 8C23.tmp 98 PID 1380 wrote to memory of 1788 1380 8C23.tmp 98 PID 1788 wrote to memory of 3356 1788 8D1D.tmp 99 PID 1788 wrote to memory of 3356 1788 8D1D.tmp 99 PID 1788 wrote to memory of 3356 1788 8D1D.tmp 99 PID 3356 wrote to memory of 2156 3356 8DC9.tmp 100 PID 3356 wrote to memory of 2156 3356 8DC9.tmp 100 PID 3356 wrote to memory of 2156 3356 8DC9.tmp 100 PID 2156 wrote to memory of 1528 2156 8EB3.tmp 101 PID 2156 wrote to memory of 1528 2156 8EB3.tmp 101 PID 2156 wrote to memory of 1528 2156 8EB3.tmp 101 PID 1528 wrote to memory of 3424 1528 8F30.tmp 102 PID 1528 wrote to memory of 3424 1528 8F30.tmp 102 PID 1528 wrote to memory of 3424 1528 8F30.tmp 102 PID 3424 wrote to memory of 660 3424 9078.tmp 103 PID 3424 wrote to memory of 660 3424 9078.tmp 103 PID 3424 wrote to memory of 660 3424 9078.tmp 103 PID 660 wrote to memory of 1508 660 9114.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d80489afae88d257cadca54eb5a41a70_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\d80489afae88d257cadca54eb5a41a70_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"23⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"24⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"25⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"26⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"27⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"28⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"29⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"30⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"31⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"32⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"33⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"34⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"35⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"36⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"37⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"38⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"39⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"40⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"41⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"42⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"43⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"44⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"45⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"46⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"47⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"48⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"49⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"50⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"51⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"52⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"53⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"54⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"55⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"56⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"57⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"58⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"59⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"60⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"61⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"62⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"63⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"64⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"65⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"66⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"67⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"68⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"69⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"70⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"71⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"72⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"73⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"74⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"75⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"76⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"77⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"78⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"79⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"80⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"81⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"82⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"83⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"84⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"85⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"86⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"87⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"88⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"89⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"90⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"91⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"92⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"93⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"94⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"95⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"96⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"97⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"98⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"99⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"100⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"101⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"102⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"103⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"104⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"105⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"106⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"107⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"108⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"109⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"110⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"111⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"112⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"113⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"114⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"115⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"116⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"117⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"118⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"119⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"120⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"121⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"122⤵PID:4208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-